Workspace
2 min read
Handle credentials safely
Keep keys scoped, separate connection access from workspace access, and revoke safely.
Before you start
- Owner or admin access to manage workspace connections.
Step by step
Create dedicated credentials
Use dedicated users, service accounts, or internal integrations where supported. Restrict app access and select the minimum provider permissions documented for each guide.
Use the connection form
Upload Apple .p8 and Google JSON files in Integrations. Use OAuth for GitHub and Slack. Do not submit secrets through chat, tickets, documentation, or release notes.
Store and review securely
Keep original keys in an approved secret store. Specita encrypts stored integration credentials. Review access when teammates leave or app ownership changes.
Disconnect and revoke
Disconnect the integration in Specita, then revoke its key or OAuth grant at the provider when it should no longer be usable. If a credential is exposed, revoke it at the provider immediately and reconnect with a replacement.
Check your setup
- No credential appears in source control or team messages.
- The provider grant matches the intended account and apps.
- A revoked credential is not reused by another pipeline or workspace.
Troubleshooting
A key appeared in a screenshot or repository
Treat it as compromised. Revoke it at the provider, replace it, and follow your organization’s incident process. Removing the screenshot is not sufficient.
Credential safety
Never share your private key or access token with support. Share only the visible error, provider name, and time of the failure.